DEPARTMENT  OF  DEFENSE 


AUDIT  REPORT 


Office  of  the 
Inspector  General 


Form  SF298  Citation  Data 


Report  Date  Report  Type 

( "DD  MON  YYYY")  P 

29Marl990  N/A 

Dates  Covered  (from...  to) 

("DD  MON  YYYY") 

Title  and  Subtitle 

Contract  or  Grant  Number 

Automated  Data  Processing  Support  of  Investigation  and 

Security  Missions  at  the  Defense  Investigative  Service 

Program  Element  Number 

Authors 

Project  Number 

Task  Number 

Work  Unit  Number 

Performing  Organization  Name(s)  and  Address(es) 

OAIG- AUD  (ATTN :  AFTS  Audit  Suggestions)  Inspector 

General,  Department  of  Defense  400  Army  Navy  Drive  (Room 
801)  Arlington,  VA  22202-2884 

Performing  Organization 

Number(s) 

90-051 

Sponsoring/Monitoring  Agency  Name(s)  and  Address(es) 

Monitoring  Agency  Acronym 

Monitoring  Agency  Report 

Number(s) 

Distribution/Availability  Statement 

Approved  for  public  release,  distribution  unlimited 

Supplementary  Notes 


Abstract 

This  is  our  final  report  on  the  Audit  of  Automated  Data  Processing  Support  of  Investigative  and  Security 
Missions  at  the  Defense  Investigative  Service  for  your  information  and  use.  Comments  on  a  draft  of  this 
report  were  considered  in  preparing  the  final  report.  The  audit  was  made  from  May  through  October  1989. 
The  objectives  of  the  audit  were  to  determine  if  the  Defense  Investigative  Service  (DIS)  was  effectively 
managing  automated  data  processing  software  and  hardware  acquisition  and  operations  that  support  its 
investigative  and  industrial  security  programs;  to  determine  if  DIS  was  complying  with  all  automated  data 
processing  DOD  Directives,  OMB  guidance,  and  DIS  regulations:  and  to  evaluate  the  internal  controls 
applicable  to  automated  data  processing  acquisition  and  operations.  DIS’  FY  1989  budget  for  automated 
information  systems  was  about  $13  million.  Overall,  the  audit  showed  that  DIS  was  adequately 
contracting  for  automated  data  processing  hardware  and  software,  and  that  during  the  past  several  years 
DIS  has  begun  to  develop  and  acquire  automated  information  systems  to  improve  the  effectiveness  of 
automated  data  processing  operations.  However,  DIS  did  not  adequately  plan  for  the  development  and 
acquisition  of  automated  information  systems  and  funds  were  unnecessarily  spent  for  automated 
information  systems  that  were  not  needed  and  never  used.  Also,  DIS  had  not  established  adequate  internal 
controls  to  implement  life-cycle  management  requirements  for  automated  information  systems.  The 
results  of  the  audit  are  summarized  in  the  following  paragraphs,  and  the  details,  audit  recommendations, 
and  management  comments  are  in  Part  II  of  this  report. 


Subject  Terms 


INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-2884 

March  29,  1990 


MEMORANDUM  FOR  DIRECTOR,  DEFENSE  INVESTIGATIVE  SERVICE 


SUBJECT:  Final  Audit  Report  on  Automated  Data  Processing  Support 

of  Investigative  and  Security  Missions  at  the  Defense 
Investigative  Service  (Report  No.  90-051) 


This  is  our  final  report  on  the  Audit  of  Automated  Data 
Processing  Support  of  Investigative  and  Security  Missions  at  the 
Defense  Investigative  Service  for  your  information  and  use. 
Comments  on  a  draft  of  this  report  were  considered  in  preparing 
the  final  report.  The  audit  was  made  from  May  through  October 
1989.  The  objectives  of  the  audit  were  to  determine  if  the 
Defense  Investigative  Service  (DIS)  was  effectively  managing 
automated  data  processing  software  and  hardware  acquisition  and 
operations  that  support  its  investigative  and  industrial  security 
programs;  to  determine  if  DIS  was  complying  with  all  automated 
data  processing  DoD  Directives,  0MB  guidance,  and  DIS 
regulations;  and  to  evaluate  the  internal  controls  applicable  to 
automated  data  processing  acquisition  and  operations.  DIS* 
FY  1989  budget  for  automated  information  systems  was  about 
$13  million. 

Overall,  the  audit  showed  that  DIS  was  adequately 
contracting  for  automated  data  processing  hardware  and  software, 
and  that  during  the  past  several  years  DIS  has  begun  to  develop 
and  acquire  automated  information  systems  to  improve  the 
effectiveness  of  automated  data  processing  operations.  However, 
DIS  did  not  adequately  plan  for  the  development  and  acquisition 
of  automated  information  systems  and  funds  were  unnecessarily 
spent  for  automated  information  systems  that  were  not  needed  and 
never  used.  Also,  DIS  had  not  established  adequate  internal 
controls  to  implement  life-cycle  management  requirements  for 
automated  information  systems.  The  results  of  the  audit  are 
summarized  in  the  following  paragraphs,  and  the  details,  audit 
recommendations,  and  management  comments  are  in  Part  II  of  this 
report . 

The  audit  showed  that  DIS  had  not  adequately  planned  for 
automated  information  systems  development  and  acquisition  that 
support  its  investigative  and  industrial  security  programs.  This 
could  result  in  delays  of  almost  3  years  in  fully  implementing  an 
automated  information  system  that  could  improve  DIS'  efficiency 
and  effectiveness.  In  addition,  DIS  unnecessarily  spent  $222,000 
for  two  mini-computers  that  did  not  meet  its  automated 
information  system  requirements  and  therefore,  were  not  used.  We 
recommended  that  DIS  establish  review  and  approval  procedures 
for  automated  information  systems  development  and  acquisition  to 


fully  implement  life-cycle  management  requirements  outlined  in 
DoD  regulatory  guidance.  We  recommended  that  DIS  establish  a 
viable  life-cycle  management  training  program  for  automated  data 
processing  personnel,  prepare  required  life-cycle  management 
documents  for  new  systems  being  developed,  and  excess  unused 
automated  data  processing  equipment.  We  also  recommended  that 
DIS  determine  and  request  the  required  personnel  billets  for  the 
development  of  future  DIS  automated  information  system 
initiatives  (page  5). 

The  audit  identified  internal  control  weaknesses  as  defined 
by  Public  Law  97-255,  Office  of  Management  and  Budget 
Circular  A-123,  and  DoD  Directive  5010.38.  Controls  were  not 
established  to  ensure  compliance  with  DoD  regulatory  guidance 
concerning  requirements  for  life-cycle  management  procedures  and 
documentation.  Recommendations  1.  and  6.  in  this  report,  if 
implemented,  will  correct  the  weaknesses.  We  could  not  determine 
the  monetary  benefits  to  be  realized  by  implementing  Recommen¬ 
dations  1.  and  6  (See  Appendix  C) .  A  copy  of  this  report  will  be 
provided  to  the  senior  official  responsible  for  internal  controls 
within  DIS.  This  report  should  be  considered  during  the 
preparation  of  the  DIS  annual  internal  control  statement  of 
assurance . 

A  draft  of  this  report  was  provided  to  the  Director,  Defense 
Investigative  Service,  on  December  28,  1989.  Management  comments 
were  received  from  DIS  on  February  28,  1990.  The  management 
comments  are  summarized  in  Part  II  of  this  report  and  the 
complete  text  is  provided  in  Appendix  B.  Management  concurred 
with  the  finding  and  with  all  recommendations  and  provided 
estimated  completion  dates  for  planned  corrective  actions.  The 
management  comments  to  a  draft  of  this  report  conformed  to  the 
provisions  of  DoD  Directive  7650.3.  No  unresolved  issues  exist 
on  the  audit  recommendations  and  internal  control  deficiencies. 
Accordingly,  additional  management  comments  on  the  final  report 
are  not  required.  This  report  identifies  no  quantifiable 
monetary  benefits. 

The  cooperation  and  courtesies  extended  the  auditors  during 
the  audit  are  appreciated.  The  audit  team  members  are  listed  in 
Appendix  E.  Please  contact  Ms.  Kathleen  M.  Stanley,  Program 
Director,  at  693-0551  (AUTOVON  223-0551)  or  Mr.  Ronald  M.  Nelson, 
Project  Manager,  at  693-0543  (AUTOVON  223-0543)  if  you  have  any 
questions  concerning  the  report.  Copies  of  this  report  are  being 
provided  to  the  activities  listed  in  Appendix  F. 


//Stephen  A.  Trodden 
Assistant  Inspector  General 
for  Auditing 
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REPORT  ON  THE  AUDIT  OP 
AUTOMATED  DATA  PROCESSING  SUPPORT 
OF  INVESTIGATIVE  AND  SECURITY  MISSIONS  AT 
THE  DEFENSE  INVESTIGATIVE  SERVICE 


PART  I  -  INTRODUCTION 


Background 

The  Defense  Investigative  Service  (DIS)  is  under  the  authority, 
direction,  and  control  of  the  Under  Secretary  of  Defense  for 
Policy.  The  Secretary  of  Defense  established  DIS  in  April  1972 
under  DoD  Directive  5105.42  to  provide  a  centrally  directed 
personnel  security  investigation  service  for  DoD  Components  and 
contractors,  and  to  conduct  inspections  of  Government  and 
contractor  facilities.  DIS  provides  the  personnel  security 
investigation  service  through  its  Personnel  Investigative  Center, 
and  processes  security  clearances  for  contractor  personnel 
through  its  Defense  Industrial  Security  Clearance  Office.  DIS 
also  conducts  inspections  of  contractor  facilities  through  its 
regional  offices. 

During  FY  1989,  DIS  employed  approximately  4,000  personnel  and 
had  a  budget  of  $164  million,  of  which  $13  million  was  for 
automated  information  systems.  As  early  as  1982,  DIS  began  to 
improve  its  operations  by  developing  and  acquiring  automated 
information  systems  to  support  its  investigative  and  industrial 
missions.  The  automated  information  systems  that  support  its 
investigative  mission  are  the  Defense  Central  Index  of 
Investigations,  the  Joint  Adjudication  Clearance  System,  the 
Defense  Integrated  Management  System,  and  the  DIS  Network.  The 
Larsen  and  Mead  automated  information  systems  support  DIS' 
Industrial  Security  Mission.  The  proposed  SUPRA  data  base 
management  system  will  support  DIS  investigative  and  industrial 
security  missions.  A  description  of  each  system  is  provided  in 
Appendix  A. 

Objectives  and  Scope 

The  objectives  of  the  audit  were  to  determine  if  DIS  was 
effectively  managing  automated  data  processing  software  and 
hardware  acquisition  and  operations  that  support  its 
investigative  and  industrial  security  programs;  to  determine  if 
DIS  was  complying  with  all  automated  data  processing  related  DoD 
Directives,  OMB  guidance,  and  DIS  regulations;  and  to  evaluate 
the  internal  controls  applicable  to  automated  data  processing 
acquisition  and  operation. 


We  evaluated  DIS'  compliance  with  laws  and  regulations  pertaining 
to  automated  data  processing  development  and  acquisition.  We 


reviewed  automated  data  processing  hardware  and  software 
justification  and  approval  documents,  contract  files,  payment  and 
accounting  records,  budget  reports,  and  automated  data  processing 
hardware  inventories  covering  the  period  from  February  1981 
through  October  1989.  We  did  not  specifically  evaluate  DIS' 
effectiveness  in  managing  automated  data  processing  operations 
because  during  the  past  several  years  DIS  has  begun  to  develop 
and  acquire  automated  information  systems  to  improve  the 
effectiveness  of  automated  data  processing  operations.  However, 
we  evaluated  maintenance  records  and  the  security  of  automated 
data  processing  hardware  and  software.  We  did  not  find  any 
significant  deficiencies  in  this  area.  Also,  we  found  no 
significant  deficiencies  in  contracting  for  automated  data 
processing  hardware  and  software.  Activities  visited  or 
contacted  are  listed  in  Appendix  D.  This  economy  and  efficiency 
audit  was  made  in  accordance  with  auditing  standards  issued  by 
the  Comptroller  General  of  the  United  States,  as  implemented  by 
the  Inspector  General,  DoD,  and  accordingly,  included  such  tests 
of  internal  controls  as  were  considered  necessary.  The  audit  was 
conducted  from  May  to  October  1989. 

Internal  Controls 


The  internal  controls  applicable  to  automated  data  processing 
hardware  and  software  acquisition  were  not  effective.  DIS  had 
not  developed  management  control  objectives  and  control 
techniques  of  internal  controls,  or  assessed  internal  controls 
applicable  to  the  acquisition  of  automated  data  processing 
hardware  and  software.  However,  DIS  completed  assessments  of 
internal  controls  at  the  Information  System  Center  and 
established  a  formal  internal  control  followup  system. 
Therefore,  the  internal  controls  applicable  to  automated  data 
processing  operations  were  deemed  effective  in  that  no 
deficiencies  were  disclosed  in  the  audit.  However,  an  internal 
control  weakness  was  found  in  DIS'  implementation  of  DoD  guidance 
to  plan  for  the  development  and  acquisition  (excluding 
contracting  operations)  of  automated  information  systems.  This 
is  discussed  in  Part  II  of  the  report. 

Prior  Audit  Coverage 

DoD  Inspector  General  Report  No.  89-007,  "Report  on  the  Fiscal 
Year  1988  Evaluation  of  the  Federal  Managers'  Financial  Integrity 
Act  of  1982  at  the  Defense  Investigative  Service,"  October  17, 
1988,  and  DoD  Inspector  General  Report  No.  88-012,  "Report  on  the 
Fiscal  Year  1987  Evaluation  of  the  Federal  Managers'  Financial 
Integrity  Act  of  1982  at  the  Defense  Investigative  Service," 
October  7,  1987,  contained  no  recommendations  and  stated  that  DIS 
was  complying  with  the  Federal  Managers'  Financial  Integrity  Act. 
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DoD  Inspector  General  Report  No.  87-032,  "Report  of  Fiscal  Year 
1986  Evaluation  of  the  Implementation  of  the  Federal  Managers' 
Financial  Integrity  Act  of  1982  at  the  Defense  Investigative 
Service,"  October  31,  1986,  stated  that  DIS  planned  to  report  in 
its  FY  1986  annual  statement  of  assurance,  to  the  Secretary  of 
Defense,  those  same  internal  control  weaknesses  reported  in  the 
1985  annual  statement  of  assurance.  We  concluded  that  the 
FY  1986  annual  statement  to  the  Secretary  of  Defense  showed  that 
DIS  was  complying  with  the  Federal  Managers'  Financial  Integrity 
Act;  therefore,  the  report  did  not  contain  any  recommendations. 

DoD  Inspector  General  Report  No.  86-034,  "Report  of  Fiscal  Year 
1985  Evaluation  of  the  Implementation  of  the  Federal  Managers' 
Financial  Integrity  Act  of  1982  at  the  Defense  Investigative 
Service,"  November  4,  1985,  recommended  that  DIS  assess  automated 
data  processing  internal  controls  at  the  Information  System 
Center  using  DoD  automated  data  processing  internal  control 
guidelines.  The  report  also  recommended  that  DIS  revise  Defense 
Investigative  Regulation  Number  08-5,  "Internal  Management 
Control  Program,"  to  establish  a  formal  follow-up  system  to 
correct  weaknesses  identified  through  the  internal  management 
process.  DIS  concurred  with  the  recommendations  and  implemented 
corrective  actions  approximately  4  years  later  to  include 
completing  assessments  of  automated  data  processing  internal 
controls  at  the  Information  Systems  Center  during  April  1989  and 
revising  Defense  Investigative  Regulation  Number  08-5,  "Internal 
Management  Control  Program,"  in  July  1989  to  establish  a  formal 
internal  control  follow-up  system. 

Prior  Automated  Data  Processing  Reviews 

The  DoD  Manpower  Data  Center  issued  a  study,  "Organization  and 
Operation  of  the  Information  Management  Function  within  the 
Defense  Investigative  Service,  Results  of  an  On-site  Review"  on 
May  18,  1988.  The  study  team  consisted  of  contractor  and 
Government  representatives  who  recommended  that  the  Information 
Systems  Division  be  placed  under  the  direct  control  of  a  new 
deputy  director  and  that  the  operating  instructions  for  that 
Division  clearly  state  that  it  must  service  the  entire 
organization  and  staff  itself  to  accomplish  its  mission.  DIS 
agreed  and  reorganized  the  Information  Systems  Division  under  a 
deputy  director  for  Information  Systems  and  Planning  with  the 
assigned  responsibility  for  supporting  DIS  overall  missions.  The 
DoD  Manpower  Data  Center  study  also  recommended  that  DIS  develop 
a  long-term  planning  document  delineating  the  functional 
requirements  of  automated  information  systems.  DIS  partially 
agreed,  and  developed  a  2-year  plan,  "DIS  Information  Systems 
Plan,"  in  January  1989. 

The  Deputy  Under  Secretary  of  Defense  for  Policy,  in  coordination 
with  the  Deputy  Assistant  Secretary  of  Defense  for 
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Administration,  issued  a  report,  ’’Defense  Investigative  Service 
Information  Systems  Review  -  A  Report  to  the  Defense  Resources 
Board,"  in  December  1987.  The  Deputy  Under  Secretary  of  Defense 
for  Policy  recommended  that  DIS'  unfunded  automated  data 
processing  initiatives  be  funded  for  the  program  period  FY  1988 
through  FY  1992.  The  Defense  Resources  Board  initiated 
corrective  action  and  funded  DIS  automated  data  processing 
initiatives  for  FY  1989  and  FY  1990,  and  additional  funding  has 
been  programmed  for  FY  1991  and  FY  1992. 

DoD  Inspector  General  Inspection  Report,  "Inspection  of  the 
Defense  Investigative  Service,"  July  16,  1985,  identified  three 
issues  related  to  automated  information  systems  in  support  of  DIS 
investigative  and  industrial  security  missions.  The  first  issue 
was  that  DIS  should  explore  creative  methods  of  conducting 
investigations  to  allow  it  to  continue  meeting  requirements 
(methods  include  automation).  DIS  corrected  this  problem  by 
funding  automated  data  processing  initiatives  for  the  program 
period  FY  1989  through  FY  1990.  The  second  issue  was  that  DIS 
should  establish  an  effective  centralized  DoD  index  of  clearance 
actions  for  all  DoD  Components  to  use.  DIS  reprogrammed  the 
Defense  Central  Index  of  Investigations  to  implement  this 
function.  The  Defense  Central  Index  of  Investigation  will 
provide  a  central  index  of  all  DoD  clearance  actions  for  all  DoD 
Components  to  use.  The  last  issue  was  that  automation  within  DIS 
was  unsatisfactory  in  life-cycle  management,  contingency 
operations  planning,  and  security;  however,  efficient  and 
effective  use  of  automated  data  processing  equipment  could  reduce 
backlogs  and  mechanize  manual  tasks.  To  correct  these  problems 
DIS  recently  initiated  the  development  of  policy  and  procedural 
guidance  to  implement  necessary  life-cycle  management 
requirements.  Also,  DIS  developed  and  implemented  SUPRA  and 
Defense  Investigative  Service  Network  to  improve  the  operation  of 
DIS'  investigative  and  security  programs  through  automation. 
However,  DIS  has  not  finalized  a  Continuity  of  Operations  Plan  to 
ensure  that  DIS  could  continue  to  operate  if  a  major  accident 
occurs,  such  as  a  fire  or  flood  in  the  computer  center  located  at 
the  Personnel  Investigations  Center. 
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PART  II  -  FINDING  AND  RECOMMENDATIONS 


Planning  for  Automated  Information  System  Development  and 
Acquisition 


FINDING 

DIS  had  not  adequately  planned  for  automated  information  system 
development  and  acquisition  that  support  its  investigative  and 
industrial  security  programs.  This  occurred  because  DIS  had  not 
established  review  and  approval  procedures  or  a  control  process 
to  fully  implement  life-cycle  management  requirements.  In 
addition,  DIS  had  not  provided  automated  data  processing 
personnel  adequate  training  in  life-cycle  management  methods  and 
practices,  and  it  had  limited  resources.  As  a  result,  DIS  could 
experience  delays  of  almost  3  years  in  developing  an  automated 
information  system  that  could  improve  its  efficiency  and 
effectiveness.  Also,  DIS  unnecessarily  spent  $222,000  for 
two  mini-computers  that  it  did  not  need  and  never  used. 

DISCUSSION  OF  DETAILS 


DoD  Guidance.  DoD  Directive  (DoDD)  7920.1,  "Life-Cycle 
Management  of  Automated  Information  Systems  (AISs),"  June  20, 
1988,  applies  the  principles  of  life-cycle  management  to  major 
and  nonmajor  automated  information  systems.  — '  Life-cycle 
management  of  an  automated  information  system  is  a  control  of 
expenditures  on  new  automated  information  systems  and  of 
expenditures  on  the  modernization  of  existing  automated 
information  systems.  DoDD  7920.1  requires  that  the  sponsoring 
DoD  Component  develop  and  implement  review  and  milestone  approval 
procedures  for  nonmajor  automated  information  system  development 
or  modernization.  The  six  life-cycle  management  phases  of  an 
automated  information  system  are  needs  justification,  concepts 
development,  design,  development,  deployment,  and  operations. 
DoDD  7920.1  also  requires  that  DoD  Components  provide  management 
oversight  and  control  of  expenditures  for  new  automated 
information  systems  and  the  modernization  of  existing  automated 
information  systems  to  ensure  that  the  desired  benefits  of  the 
system  are  achieved.  In  addition,  DoDD  7920.1  requires  the 
preparation  of  principal  life-cycle  management  documents  when 
planning  for  the  development  or  modernization  of  an  automated 
information  system.  These  documents  include  a  mission  need 


— /  A  nonmajor  automated  information  system  does  not  have 
anticipated  program  costs  from  justification  through  deployment 
in  excess  of  $100  million,  or  estimated  program  costs  in  excess 
of  $25  million  in  any  single  year,  or  is  not  designated  as  being 
of  special  interest  by  the  Office  of  the  Secretary  of  Defense. 
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statement,  a  functional  requirements  document,  a  programming 
resource  justification  (budget),  and  a  comprehensive 
implementation  plan. 

PIS  Automated  Information  Systems  Guidance.  DIS  has  issued 
general  life-cycle  management  policy  and  criteria,  but  has  done 
relatively  little  to  ensure  that  the  policy  and  procedures  were 
in  compliance  with  DoDD  7920.1.  DIS  developed  DIS 
Regulation  21-5,  "Selection  and  Acquisition  of  Automatic  Data 
Processing  Resources,"  dated  August  24,  1988,  which  designated 
the  Deputy  Director,  Information  Systems  and  Planning  as  the 
senior  automated  data  processing  policy  official.  The 
responsibility  of  this  official  includes  selection  and 
acquisition  of  all  automated  data  processing  resources  within 
DIS,  to  include  hardware  and  software  and  necessary  contractor 
support.  However,  DIS  Regulation  21-5  does  not  provide  any 
guidance  for  planning,  prioritizing,  reviewing  or  approving  the 
selection  of  automated  data  processing  equipment. 

DIS  also  developed  DIS  Operating  Instruction  Number  34,  "Life- 
Cycle  Management,"  May  12,  1988,  which  established  life-cycle 
standards  for  automated  information  systems  within  DIS.  This 
instruction  outlines  general  criteria  to  be  used  to  determine  if 
life-cycle  management  controls  would  be  applicable  to  the 
development  of  proposed  automated  information  systems.  However, 
DIS  Operating  Instruction  Number  34  does  not  provide  detailed 
operating  instructions  or  procedures  implementing  life-cycle 
management  requirements  outlined  in  DoDD  7920.1.  For  example, 
this  guidance  does  not  provide  for  a  review  and  approval  process 
for  automated  information  system  development  and  acquisition, 
which  would  ensure  that  management  decisions  and  related 
expenditures  are  based  on  the  anticipated  benefits  of  a  system. 
Although  DIS  established  an  ADP  Steering  Committee,  consisting  of 
the  DIS  Director  and  various  functional  managers,  to  review  and 
approve  the  development  of  DIS  automated  information  systems, 
this  committee  has  never  been  given  an  official  charter  and  has 
not  adequately  functioned  in  its  intended  capacity.  The  ADP 
Steering  Committee  should  be  an  integral  part  of  an  established 
review  and  approval  process. 

At  the  completion  of  our  audit,  DIS  had  begun  developing  an 
internal  instruction  outlining  standard  procedures  to  implement 
life-cycle  management  requirements  as  prescribed  by  DoDD  7920.1, 
which  were  not  included  in  DIS  Regulation  21-5  or  in  DIS 
Operating  Instruction  Number  34.  This  draft  internal  instruction 
should  provide  standard  procedures  for  the  development  and 
acquisition  of  DIS  automated  information  systems. 

DIS  Automated  Information  Systems.  DIS  developed 
three  automated  information  systems  to  improve  its  efficiency  and 
effectiveness.  First  was  SUPRA,  a  data  base  management  system 
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that  integrated  operational,  investigative  and  industrial  data 
into  an  agency-wide  data  base.  Second  was  the  Defense 
Investigative  Service  Network,  a  system  of  micro-computers  with 
word  processing  and  communications  capabilities  that  was  used  to 
transmit  completed  reports  of  personnel  investigations.  Third 
was  the  Electronic  Transmission  Program,  a  telecommunications 
system  that  was  used  to  automate  the  contractor  personnel 
security  clearance  process.  Detailed  discussions  of  each 
automated  information  system  follow. 

Data  Base  Management  System.  In  April  1987,  DIS 
installed  a  data  base  management  system  called  SUPRA.  SUPRA 
Version  1  integrated  all  operational  investigative  and  industrial 
data  normally  held  in  separate  master  files  into  an  agency-wide 
data  base.  This  data  base  consolidated  the  master  files  of  the 
Defense  Integrated  Management  System,  the  Defense  Central  Index 
of  Investigations,  the  Joint  Adjudication  Clearance  System, 
Larsen,  and  Mead.  Each  operational  system  was  functionally 
redesigned,  rewritten,  and  expanded  into  SUPRA  costing  DIS  an 
estimated  $427,000  (costs  for  reprogramming  the  Defense 
Integrated  Management  System  and  Mead  into  SUPRA  have  not  been 
determined).  DIS  planned  to  replace  the  Defense  Integrated 
Management  System  with  the  Case  Control  Management  System  when 
the  system  was  transferred  to  SUPRA.  SUPRA' s  acquisition  and 
development  costs  were  estimated  at  $2.04  million  (excluding  the 
$427,000  reprogramming  costs)  from  FY  1987  through  FY  1994.  The 
introduction  of  SUPRA  into  DIS'  automated  operations  could 
provide  intangible  benefits  that  would  increase  the  efficiency 
and  effectiveness  of  DIS'  investigative  and  industrial 
missions.  Potential  benefits  of  the  system  included  centralized 
availability  of  data;  file  expansion  without  mass  changes;  data 
redundancy  reduction;  a  data  dictionary  that  defined  data 
elements  and  their  meanings;  a  higher  level  language  that  allowed 
simplified  programming  and  maintenance;  a  relational  database;  ad 
hoc  query  capability,  which  more  easily  addressed  requests;  and 
referential  integrity  of  files,  which  allowed  validity  checks 
among  different  operational  systems. 

DIS  planned  to  upgrade  SUPRA  by  incorporating  SUPRA  Version  2. 
SUPRA  Version  2  will  provide  DIS  with  the  additional  benefits  of 
the  American  National  Standards  Institute  structured  query 
language  required  for  DoD  automated  information  systems;  the  ease 
of  table  generation;  operation  of  the  system  on  a  24-hour  basis; 
a  relational  database;  and  the  ease  of  maintenance  of  the 
system.  DIS  estimated  that  SUPRA  Version  2  will  cost 
$141,730  including  a  $21,000  installation  fee,  plus  $2,000  per 
month  for  additional  maintenance  costs.  The  $141,730  is  part  of 
SUPRA' s  overall  development  costs  of  $2.04  million. 

DIS  had  not  adequately  planned  SUPRA 's  development. 
Additionally,  DIS  had  not  developed  the  necessary  life-cycle 
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management  planning  documents  for  SUPRA  required  by 
DoDD  7920.1.  This  documentation  would  have  provided  the 
justification  for  developing  SUPRA;  the  functional  requirements, 
including  required  hardware  and  software,  of  SUPRA;  and  the 
system  design  and  total  funding  required  for  SUPRA.  Although  DIS 
had  developed  a  data  base  management  system  implementation  plan 
for  SUPRA,  dated  September  1987,  the  plan  was  inadequate  because 
it  did  not  address  the  integration  of  multiple  operational 
systems.  This  plan  stated  that  implementation  of  an  agency-wide 
data  base  management  system  would  require  a  carefully  developed 
plan  covering  multiple  operational  systems  over  several  years. 
DIS  had  neither  developed  the  detailed  implementation  plan  for 
SUPRA  nor  complied  with  the  life-cycle  management  requirements  of 
DoDD  7920.1.  DIS  planned  for  all  five  of  the  operational  systems 
to  be  incorporated  into  SUPRA  by  September  1989.  However,  DIS 
estimates  showed  delays  of  up  to  3  years  in  making  SUPRA  fully 
operational.  These  delays  were  caused  by  the  absence  of 
functional  requirements  for  the  five  operational  systems  and  the 
sensitivity  of  the  SUPRA  project  to  other  higher  priority 
projects  within  DIS.  The  following  table  reflects  the 


implementation 

dates  for  each  of  the 

five  operational 

systems . 

System 

Initial  Date  of 
Implementation 

Revised  Date  of 
Implementation 

Delay 

Months 

CCMS  (DIMS)  y 

March  1989 

December  1991 

33  y 

dc  1 1  y 

February  1989 

November  1989 

9 

jacs  y 

February  1989 

September  1991 

31 

Larsen 

October  1988 

October  1990 

24 

Mead 

September  1989 

February  1992 

29 

Case  Control  Management  System  {Defense  Investigations 
Management  System) 

— /  CCMS  development  was  on  hold  at  the  time  of  the  audit. 

— /  Defense  Central  Index  of  Investigation 
— /  Joint  Adjudication  Clearance  System 


Also,  DIS  has  not  adequately  planned  for  the  procurement  of  the 
new  central  processing  unit,  which  is  crucial  to  fully  implement 
SUPRA.  DIS  did  not  have  sufficient  hardware  processing  power  and 
disk  space  for  SUPRA  or  for  any  of  the  other  major  system 
enhancements.  We  found  that  DIS  had  conducted  a  life-cycle  study 
for  the  acquisition  of  a  new  central  processing  unit,  dated 
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April  1989,  which  stated  that  SUPRA  would  be  the  largest  user, 
but  the  central  processing  unit  would  not  be  procured  before 
March  1990.  Therefore,  although  SUPRA  was  installed  in  1987,  it 
could  not  become  fully  operational  until  reprogramming  of  the 
five  operational  systems  was  complete  and  the  new  central 
processing  unit  was  functional. 

Defense  Investigative  Service  Network.  DIS  installed 
Defense  Investigative  Service  Network  Phase  1  in  September  1986 
as  an  electronic  telecommunications  network  that  allowed  for  the 
one-way  transmission  of  completed  reports  of  investigations  from 
DIS'  field  offices  to  the  Personnel  Investigations  Center. 
Defense  Investigative  Service  Network  Phase  1  was  fully 
operational  in  1988.  The  one  major  benefit  of  Defense 
Investigative  Service  Network  Phase  1  was  that  the  network 
reduced  the  time  necessary  for  investigative  case  completion. 
Development  and  acquisition  costs  for  Defense  Investigative 
Service  Network  Phase  1  were  estimated  to  be  $4  million  from 
FY  1986  to  FY  1990  for  hardware,  software,  and  maintenance.  DIS 
began  developing  the  Defense  Investigative  Service  Network 
concept  in  early  1980  and  conducted  a  6-month  pilot  study  to  test 
the  theory.  After  the  Defense  Investigative  Service  Network 
concept  was  approved  in  June  1981,  DIS  developed  a  statement  of 
requirements  and  an  implementation  cost  estimate  for  the 
project.  However,  a  mission  need  statement,  a  programming 
resource  document,  and  an  implementation  plan  were  not  developed 
for  Defense  Investigative  Service  Network. 

In  October  1986,  DIS  considered  another  concept  and  planned  to 
initiate  a  pilot  study  to  determine  the  feasibility  for  the 
electronic  transmission  of  completed  investigative  case  files 
from  the  field  offices  to  its  regional  offices  rather  than  to  the 
Personnel  Investigations  Center.  These  consolidated 
investigative  case  files  were  to  be  processed  at  DIS  regional 
offices  and  then  transmitted  from  DIS  regional  offices  to  the 
Personnel  Investigations  Center  through  the  Defense  Data  Network 
instead  of  Defense  Investigative  Service  Network.  DIS  purchased 
a  Canaan  Corporation  DCS  5800  mini-computer  for  $62,000  from  the 
Federal  Technology  Corporation  to  support  this  project.  DIS 
initially  planned  to  place  the  Canaan  mini-computer  in  a  regional 
office  to  test  the  concept  of  consolidated  processing  of 
investigative  case  files.  However,  the  mini-computer  was  never 
used  because  DIS  officials  determined  several  months  after  its 
delivery  that  the  mini-computer  software  and  hardware  did  not 
work.  DIS  contracting  office  was  able  to  get  the  Federal 
Technology  Corporation  to  provide  the  correct  software  but  it  was 
unable  to  obtain  the  correct  hardware  because  the  Cannan 
Corporation  went  out  of  business.  As  a  result,  DIS  could  not 
conduct  the  pilot  study  and  unnecessarily  spent  $62,000  on  a 
mini-computer  that  could  not  be  used. 
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At  the  time  of  the  audit,  DIS  was  in  the  process  of  planning  for 
the  development  and  acquisition  for  Defense  Investigative  Service 
Network  Phase  2,  which  will  allow  for  two-way  communication 
between  DIS'  field  offices  and  the  Personnel  Investigations 
Center.  Defense  Investigative  Service  Network  Phase  2  would 
continue  to  allow  transmission  of  completed  reports  of 
investigation  from  the  field  offices,  but  would  also  allow  the 
Personnel  Investigations  Center  to  transmit  personnel  security 
questionnaires  and  investigative  case  leads  to  the  field 
offices.  A  project  manager  was  assigned  to  Defense  Investigative 
Service  Network  Phase  2,  but  system  requirements  (hardware, 
software,  and  funding)  have  not  been  determined  for  modernizing 
this  system.  DIS  officials  should  incorporate  life-cycle 
management  procedures  and  controls  when  developing  Defense 
Investigative  Service  Network  Phase  2. 

Electronic  Transmission  Program.  In  December  1984,  DIS 
and  the  Aerospace  Industries  Association  jointly  proposed  a  pilot 
study  to  automate  the  contractor  personnel  security  clearance 
process  at  the  Defense  Industrial  Security  Clearance  Office.  DIS 
conducted  the  study  in  two  phases.  Phase  1  began  in  January  1986 
and  involved  using  an  IBM  System  36  mini-computer,  which  was 
provided  by  IBM  for  trial  testing  at  no  cost  to  the  Government., 
Personnel  security  questionnaires  and  Letters  of  Consent  — ' 
between  the  Defense  Industrial  Security  Clearance  Office  and  the 
contractors  were  electronically  transmitted  using  the 
IBM  System  36  instead  of  the  U.  S.  Postal  Service.  Six  Aerospace 
member  contractors  volunteered  to  participate  in  the  study  and  in 
the  on-line  transmission. 

In  March  1987,  DIS  determined  that  the  approach  used  in  Phase  1 
was  not  the  best  method  to  meet  the  requirements  of  the 
electronic  transmission  program  and  decided  to  use  an  electronic 
mail  service  instead.  In  March  1988,  DIS  contracted  with 
CompuServe  Incorporated  and  proceeded  into  Phase  2  to  test  the 
use  of  a  telecommunication  service  to  electronically  transmit 
personnel  security  questionnaires.  Phase  2  involved  the  same 
procedure  as  Phase  1  except  that  the  personnel  security 
questionnaire  files  were  created  on  a  personal  computer  located 
at  the  contractor's  facility  and  transmitted  to  the  Defense 
Industrial  Security  Clearance  Office  through  a  public  data 
network.  Using  this  method,  DIS  needed  only  a  small  personal 
computer  instead  of  the  IBM  System  36. 


— /  Personnel  security  questionnaire  -  clearance  application  form 
to  request  a  clearance  for  contractor  personnel. 


— /  Letter  of  Consent  -  document  granting  clearance  for  contractor 
personnel . 
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Even  though  the  results  of  Phase  1  were  already  known  in 
February  1987,  DIS  contracted  for  a  similar  mini-computer, 
IBM  System  38,  for  about  $145,000.  DIS  officials  initiated 
discussions  with  IBM  to  purchase  IBM  System  38  before  the  results 
of  the  pilot  study  were  complete.  The  cost-free  use  of  the  IBM 
System  36  may  have  influenced  DIS  to  buy  an  IBM  system  instead  of 
considering  other  options.  In  our  opinion,  the  DIS  officials  who 
initiated  discussions  with  IBM  for  the  purchase  of  an  IBM 
System  38  acted  hastily  and  did  not  involve  the  contracting 
officer  in  these  discussions.  As  a  result,  there  were  strong 
indications  that  DIS  officials  made  representations  to  IBM  that 
could  have  been  construed  as  a  commitment  to  purchase  IBM 
System  38.  However,  the  system  was  not  paid  for  or  delivered 
until  a  contract  was  signed.  Although  the  IBM  System  38  was 
purchased,  it  was  never  used.  In  addition  to  the  cost  of  the 
equipment  ($145,000),  DIS  spent  about  $9,000  for  site  preparation 
and  $6,000  for  a  maintenance  contract,  a  total  of  $160,000. 

DIS  failed  to  follow  DoD  regulatory  guidance  for  the  acquisition 
of  IBM  System  38.  DoDD  7920.1  requires  complete  planning, 
including  life-cycle  costs,  prior  to  the  development  and 
acquisition  of  any  automated  system.  Although  DIS  prepared  a 
life-cycle  plan  it  was  not  adequate  and  did  not  include  complete 
program  requirements  and  implementation  plans.  If  DIS  had 
developed  and  implemented  adequate  approval  and  review  procedures 
for  the  acquisition  of  the  automated  data  processing  equipment, 
the  proposed  purchase  of  IBM  System  38  would  have  been  discussed 
and  denied  because  the  mini-computer  was  not  needed  to  meet  DIS' 
electronic  transmission  requirement.  DIS  looked  for  other  ways 
to  use  the  IBM  System  38,  but  it  was  not  successful.  DoD 
Manual  7950. 1M,  "Defense  Automation  Resources  Management  Manual," 
specifies  that  excess  automation  equipment  is  to  be  returned  to 
Defense  Automation  Resources  Information  Center.  At  the 
completion  of  our  audit,  October  1989,  DIS  had  not  contacted 
Defense  Automation  Resources  Information  Center  to  report  the 
mini-computer  as  excess  property. 

Resources  for  Automated  Information  Systems.  In  its 
December  1987  study,  the  Office  of  the  Deputy  Under  Secretary  of 
Defense  for  Policy  identified  $10.5  million  in  unfunded  automated 
data  processing  requirements  at  DIS.  This  study  was  requested  by 
the  Defense  Resources  Board  to  identify  how  automated  data 
processing  enhancements  and  changed  procedures  could  make  DIS' 
investigative  and  industrial  security  missions  more  efficient  and 
productive.  The  $10.5  million  was  identified  to  complete 
automated  data  processing  modernization  goals  planned  for  the 
5-year  period  from  FY  1988  through  FY  1992.  DIS  did  not  receive 
any  of  the  $10.5  million  in  FY  1988;  however,  DIS  did  receive 
$4.9  million  in  FY  1989.  Of  the  $4.9  million  received, 
$2.1  million  was  used  for  procurement  of  automated  data 
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processing  equipment  and  $2.8  million  was  used  for  operations. 
DIS  officials  stated  that  $2.1  million  was  used  to  procure  a 
central  processing  unit  upgrade  (about  $1.8  million)  and 
additional  memory  capacity  for  the  unit  (about  $300,000).  The 
$2.8  million  was  used  for  operation  and  maintenance  of  personal 
computers  already  on  hand  and  for  the  procurement  of  a  local  area 
network.  DIS  plans  to  split  the  remaining  $5.6  million  over  a 
3-year  period  on  maintenance  for  the  computers  and  the  central 
processing  unit.  DIS  received  $2.1  million  for  FY  1990,  and  the 
remaining  $3.5  million  has  been  programmed  for  FY  1991  and 
FY  1992. 

In  June  1988,  DIS  reorganized  the  management  structure, 
established  the  Information  Systems  and  Planning  Directorate  at 
DIS  Headquarters,  and  established  new  personnel  authorizations 
for  the  Information  Systems  Center.  At  that  time,  the 
Information  Systems  Center's  authorized  personnel  positions  were 
reduced  from  86  to  77.  DIS  officials  conducted  a  study  and 
issued  an  internal  memorandum,  "Anticipated  Distribution  of 
Personnel  Authorizations,"  to  assess  the  Information  Systems 
Center's  personnel  posture.  This  study  showed  that  of  the 
77  positions  authorized,  the  Information  Systems  Center  would 
have  12  vacancies  by  the  end  of  June  1988  because  of  retirement 
and  loss  of  personnel  to  other  agencies.  These  staffing 
shortages  could  have  weakened  DIS'  ability  to  fully  implement 
life-cycle  management  requirements  for  the  development  of 
automated  information  systems.  Further,  DIS  officials  stated 
that  of  the  77  positions  authorized,  8  would  require  life-cycle 
management  training.  DIS  provided  life-cycle  management  training 
for  four  information  systems  personnel,  of  which  two  have  left 
the  Agency.  Also,  DIS  had  seven  positions  authorized  in  the 
Information  Systems  and  Planning  Directorate.  DIS  officials 
stated  that  two  of  the  seven  positions  would  require  life-cycle 
management  training.  As  of  October  31,  1989,  DIS  had  not 
provided  training  for  the  two  positions. 

DIS  needed  to  place  more  emphasis  on  personnel  and  life-cycle 
management  training  with  the  continued  development  of  the  SUPRA 
data  base  management  system.  Defense  Investigative  Service 
Network  Phase  2,  the  Personnel  Security  Questionnaire  Electronic 
Transmission  Program,  and  the  proposed  development  of  new 
automated  information  systems,  such  as  the  Case  Control 
Management  System.  If  the  number  of  people  assigned  to  the 
Information  Systems  Center,  as  well  as  the  life-cycle  management 
training  provided  to  the  Information  Systems  Center  and  the 
Information  Systems  Planning  Directorate,  remain  as  they  were 
during  the  audit,  they  will  not  be  sufficient  to  manage  the 
anticipated  workload  increase. 
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Development  of  Future  Systems  at  PIS.  Future  plans  for  the 
development  of  automated  information  systems  at  DIS  include 
developing  the  Case  Control  Management  System,  which  will  replace 
the  Defense  Integrated  Management  System  in  SUPRA.  The  Case 
Control  Management  System  will  be  a  data  base  oriented  system 
that  will  automate  redundant  and  manual  case  processing  and 
control  procedures.  It  will  also  provide  investigative  and 
management  information  in  an  electronic  format. 

At  the  time  of  the  audit,  the  Case  Control  Management  System  was 
in  the  concept  development  phase.  BDM  Corporation  completed  a 
functional  analysis  of  the  system  in  May  1989  and  the  contractor 
estimated  that  it  would  take  about  6  years  to  fully  develop  and 
implement  the  system.  BDM  Corporation  also  estimated  that 
development  costs  for  the  Case  Control  Management  System  would 
total  $9  million  including  software  development  and  hardware 
procurement.  The  Case  Control  Management  System  could  provide 
DIS  with  potential  benefits  that  include  electronic  interface 
with  other  automated  systems,  automatic  update  of  information 
systems  based  on  receipt  of  electronic  data  from  requestors, 
electronic  transmission  of  investigative  case  leads  to  the  field 
offices  and  receipt  of  investigation  reports  from  field  offices, 
and  automatic  analysis  of  case  data  to  determine  when  the  cases 
are  completed.  The  Case  Control  Management  System  could  also 
maintain  an  electronic  file  copy  of  completed  reports  as  well  as 
produce  copies  of  the  completed  reports  for  requestors. 

At  the  end  of  our  audit,  DIS  had  placed  the  development  of  the 
Case  Control  Management  System  on  hold.  If  DIS  does  continue 
developing  the  Case  Control  Management  System,  emphasis  should  be 
placed  on  ensuring  that  the  system  goes  through  a  management 
review  and  approval  process  and  that  required  life-cycle 
management  controls  and  procedures  are  implemented. 

Potential  Monetary  Benefits.  DIS  should  develop  alternative 
methods  and  avoid  using  the  General  Accounting  Office's 
methodology  in  determining  the  monetary  benefits  that  could  be 
obtained  if  personnel  security  clearance  processing  was 
automated.  The  General  Accounting  Office  determined  in  its 
September  15,  1981,  report  "Faster  Processing  of  DoD  Personnel 
Security  Clearances  Could  Avoid  Millions  in  Losses,"  that  it  cost 
the  Government  $21  per  day  for  each  DoD  employee  that  did  not 
have  access  to  classified  information.  The  report  also  stated 
that  it  cost  the  Government  $43  per  day  for  each  contractor 
employee  that  did  not  have  a  clearance. 

In  1987,  the  Under  Secretary  of  Defense  for  Policy  used  the 
General  Accounting  Office's  report  to  determine  that  the 
Government  could  potentially  save  approximately  $77.3  million  if 
DIS  developed  the  necessary  automated  information  systems.  DIS 
utilized  this  figure  to  compute  monetary  savings  to  the 
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Government  as  part  of  the  basis  for  developing  automated 
information  systems  that  would  be  used  to  process  clearances 
faster.  DIS  began  the  development  of  its  automated  information 
system  initiatives  but  has  yet  to  fully  implement  all  of  the 
automated  initiatives,  SUPRA  and  the  Case  Control  Management 
System,  that  would  induce  proposed  monetary  benefits. 

The  General  Accounting  Office's  methodology  of  computing  monetary 
benefits  has  been  rendered  obsolete  by  the  introduction  of 
interim  clearances.  DoD  Regulation  5200. 2-R,  "Personnel  Security 
Program,"  section  3-401,  issued  January  1987,  established 
criteria  for  issuing  interim  Confidential,  Secret  and  Top  Secret 
clearances.  The  requesting  DoD  Components  for  DoD  employees  or 
DIS  Defense  Industrial  Security  Clearance  Office  for  contractor 
employees  can  issue  these  interim  clearances.  Interim  clearances 
can  be  issued  within  2.1  to  5.2  calendar  days.  As  a  result,  the 
Government's  use  of  interim  clearances  has  eliminated  virtually 
all  losses  that  the  delays  in  processing  security  clearances 
caused. 

Other  automation  initiatives  DIS  considered  that  could  provide 
monetary  savings  to  the  Government  include  the  Personnel  Security 
Questionnaire  Electronic  Transmission  Program,  Electronic  Storage 
of  Files,  Defense  Investigative  Service  Network,  SUPRA  and  the 
Case  Control  Management  System.  DIS  has  only  been  able  to 
implement  Defense  Investigative  Service  Network  Phase  1,  which 
decreased  the  amount  of  mail  time  for  investigative  case 
completions  from  approximately  10  to  6  days.  Monetary  benefits 
for  SUPRA  cannot  be  determined  until  DIS  has  completed  all 
requirements  for  the  system;  however,  other  intangible  benefits 
the  system  could  provide  were  discussed  earlier  in  the  report. 
The  development  of  the  other  systems  mentioned  and  their  related 
monetary  benefits  cannot  be  determined  until  DIS  establishes  its 
long-range  automation  goals. 

Overall  Conclusions.  We  determined  that  the  contributing 
factors  for  DIS'  noncompliance  with  automated  information  system 
DoD  regulatory  guidance  included  an  absence  of  life-cycle 
management  implementing  and  milestone  approval  guidance  and 
procedures,  a  lack  of  training  and  knowledge  in  life-cycle 
management  methods  and  controls,  and  a  lack  of  resources  (funding 
and  personnel).  DIS  had  not  determined  or  requested  the  required 
personnel  to  ensure  conformance  with  life-cycle  management 
requirements  for  the  continued  development  of  DIS  automated 
information  system  initiatives. 

We  also  determined  that  DIS  did  not  fully  comply  with  the 
requirements  of  DoDD  7920.1  for  developing  SUPRA  or  Defense 
Investigative  Service  Network  Phase  1.  DIS  did  not  prepare  the 
required  planning  documents  prior  to  developing  these  systems. 
In  addition,  DIS  did  not  fully  comply  with  the  requirements  of 
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DoDD  7920.1  concerning  life-cycle  management  planning  prior  to 
the  development  of  the  Personnel  Security  Questionnaire 
Electronic  Transmission  Program  and  the  acquisition  of  the  IBM 
System  38  mini-computer.  DIS  had  not  implemented  an  adequate 
review  and  approval  process  that  would  provide  a  mechanism  of 
control  in  acquiring  automated  information  systems.  Furthermore, 
DIS  had  not  determined  its  long-range  automation  goals  and  the 
related  monetary  benefits  of  its  automated  information  system 
initiatives.  However,  at  the  completion  of  our  audit,  DIS 
officials  had  begun  to  develop  policy  and  procedural  guidance  to 
implement  life-cycle  management  requirements  to  include  a  review 
and  milestone  approval  procedure  for  the  development  and 
acquisition  of  automated  information  systems. 

RECOMMENDATIONS  FOR  CORRECTIVE  ACTION 
We  recommend  that  the  Director,  Defense  Investigative  Service: 

1.  Establish  review  and  approval  procedures  for  automated 
information  systems  development  and  acquisition  to  fully 
implement  life-cycle  management  requirements  outlined  in  DoD 
Directive  7920.1,  "Life-Cycle  Management  of  Automated  Information 
Systems  (AISs),"  June  20,  1988. 

2.  Task  the  SUPRA  Project  Manager  to  determine  the 
functional  requirements  for  each  of  the  five  application  systems, 
develop  an  integration  plan  for  the  multiple  applications  for 
incorporation  into  SUPRA,  and  determine  and  budget  funds,  as 
necessary,  to  complete  the  development  of  SUPRA. 

3.  Task  the  Defense  Investigative  Service  Network  Project 
Manager  to  prepare  the  required  life-cycle  management  documents 
to  include  Mission  Need  Statement;  functional  requirements; 
program  resource  planning  document;  implementation  plan;  and 
other  life-cycle  management  requirements  documents  in  accordance 
with  DoD  Directive  7920.1,  prior  to  the  development  and 
implementation  of  Defense  Investigative  Service  Network  Phase  2. 

4.  Determine  if  IBM  System  38  and  Canaan  DCS  5800  can  be 
used  to  meet  DIS  automated  data  processing  requirements.  If  not, 
dispose  of  the  two  mini-computers  as  excess  property  in 
accordance  with  DoD  Manual  7950. 1M,  "Defense  Automation  Resources 
Management  Manual,"  September  26,  1988. 

5.  Determine  and  request  the  required  personnel  to  fully 
implement  life-cycle  management  requirements  for  the  development 
of  future  automated  information  systems. 

6.  Establish  a  viable  life-cycle  management  training 
program  to  provide  DIS  automated  data  processing  officials 
sufficient  training  and  knowledge  in  life-cycle  management 
methods  and  practices. 
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7.  Develop  management  control  objectives,  control 
techniques  of  internal  controls,  and  assess  internal  controls 
applicable  to  the  acquisition  of  automated  data  processing 
hardware  and  software. 


MANAGEMENT  COMMENTS 

Management  concurred  with  the  finding  and  with  all  recommen¬ 
dations  and  provided  estimated  completion  dates  for  planned 
corrective  actions.  DIS'  Information  Systems  and  Planning 
Directorate  has  staffed  a  draft  life-cycle  management  directive 
to  establish  a  review  and  approval  procedure  for  developing 
automated  information  systems  in  accordance  with  DoD  regulatory 
guidance.  The  required  life-cycle  management  documents  are  being 
prepared  for  the  SUPRA  data  base  management  system  and  will  be 
prepared  for  Defense  Investigative  Service  Network  Phase  2  during 
the  planning  phase.  DIS'  Information  Systems  and  Planning 
Directorate  and  the  Information  Systems  Center  are  being 
functionally  realigned  to  ensure  that  program  managers  will  be 
responsible  for  automated  information  systems  development,  and  to 
aid  in  allocating  resources  for  the  development  of  automated 
information  systems.  DIS  has  also  provided  training  to  two 
automated  data  processing  personnel  on  life-cycle  management 
procedures.  Additional  training  for  other  automated  data 
processing  personnel  is  scheduled  for  FY  1991.  Disposal  actions 
are  underway  for  one  of  the  two  unused  mini-computers  and  a 
determination  on  the  IBM  System  38  will  be  made  pending  the 
results  of  a  requirements  study  for  DIS  automated  data  processing 
initiatives.  Finally,  internal  control  initiatives,  including 
the  development  of  management  control  objectives  and  control 
techniques,  and  an  internal  control  tracking  system  will  be 
completed  by  September  28,  1990.  The  complete  text  of  management 
comments  is  provided  in  Appendix  B. 
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AUTOMATED  INFORMATION  SYSTEMS  WITHIN 
DEFENSE  INVESTIGATIVE  SERVICE 


SUPRA  -  a  proposed  corporate  data  base  management  system  that 
will  integrate  all  operational  investigative  and  industrial  data 
into  an  agency-wide  data  base. 

Defense  Central  Index  of  Investigation  -  an  index  of  DoD 
investigative  and  criminal  files  stored  throughout  DoD.  The 
index  includes  clearance  entries  for  DoD  personnel  who  have  been 
granted  security  clearances,  and  facility  records. 

Joint  Adjudication  Clearance  System  -  provides  case  management 
for  DoD  Components  that  track  cases  through  the  adjudication 
process.  The  system  creates  input  to  a  variety  of  DoD  agencies 
based  on  agency  needs.  This  system  also  provides  input  to  the 
Defense  Central  Index  of  Investigation. 

Defense  Investigations  Management  System  -  manages  the  processing 
of  open  investigation  and  National  Agency  Checks  on  DoD 
personnel.  This  system  is  scheduled  to  be  replaced  by  Case 
Control  Management  System. 

Case  Control  Management  System  -  a  proposed  data  base-oriented 
system  that  will  automate  redundant  and  manual  case  processing 
and  control  procedures.  It  will  also  provide  investigative  and 
management  information  in  an  electronic  format.  This  system  is 
in  a  system  definition  phase. 

Larsen  -  the  master  file  that  lists  contractor  facilities  with 
clearances.  The  master  file  is  used  to  administer  the  contractor 
facility  inspection  program.  Inspections  of  the  facilities  are 
conducted  periodically,  depending  on  the  type  of  clearance 
granted . 

Mead  -  tracks  clearance  requests  for  contractor  personnel  from 
receipt  at  Defense  Industrial  Security  Clearance  Office  through 
the  investigation  process  at  the  Personnel  Investigations  Center, 
assists  in  adjudicating  clearance  requests,  and  produces  Letters 
of  Consent  for  favorable  adjudications.  DLA  operates  the  system 
for  Defense  Industrial  Security  Clearance  Office  through  two 
interservice  support  agreements  at  a  cost  of  about  $750,000, 
annually . 

Defense  Investigative  Service  Network  -  A  telecommunication 
system  used  to  transfer  personnel  investigation  case  file 
information  from  the  field.  The  costs  for  this  system  will  be 
incurred  with  or  without  the  development  of  SUPRA. 
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APPENDIX  A 


DEFENSE  INVESTIGATIVE  SERVICE 

1900  HALF  ST. i  S.W. 
WASHINGTON,  O.C.  20324-1700 


FEB  2  8  1990 
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MEMORANDUM  FOR  THE  INSPECTOR  GENERAL,  DEPARTMENT  OF  DEFENSE 
SUBJECT:  Draft  Audit  Report,  Project  No.  9ME-0042 


Attached  please  find  our  comments  regarding  subject  report.  Should  you 
have  any  questions  or  require  additional  information,  please  contact 
Mr.  Mel  deGuzman  at  475-1059. 


fOHN  F.  DONNELLY 
Director 


Attachment 


19 


APPENDIX  B 
Page  1  of  2 


1.  Concur.  A  draft  DIS  Life-Cycle  Management  Directive  has  been  staffed 
to  headquarters,  regional  and  field  elements.  The  final  DIS  Directive 
will  be  published  by  September  28,  1990  and  will  be  compliant  with  DoD 
Life-Cycle  Management  Directives. 

2.  Concur.  The  DIS  data  base  manager  is  preparing  an  action  plan  to 
determine  functional  requirements  and  an  integration  plan  for 
incorporating  existing  application  systems  into  the  SUPRA  data  base 
environment.  An  integration  plan  with  resource  requirements  will  be 
prepared  by  September  28,  1990. 

3.  Concur.  Life-cycle  management  documents  compliant  to  DoD  Life-Cycle 
Management  Directives  will  be  prepared  for  DISNET  Fhase  2. 

4.  Concur.  The  Canaan  DCS  5800  has  been  excessed  in  accordance  with 
DoD  7950. 1-M,  dated  September  26,  1988.  A  detailed  review  of  AIS 
requirements  is  underway  to  determine  whether  the  IBM  System  38  can  be 
used  to  support  DIS  initiatives.  A  determination  is  expected  by 
September  28,  1990. 

5.  Concur.  V0200  and  D0200  have  realigned  along  DIS  functional  lines. 
V0200  program  managers  have  been  identified  and  will  be  responsible  for 
life-cycle  management  of  all  AIS  development  in  the  agency.  Project 
plans  are  being  adjusted  for  future  AIS  programs;  resources  will  be 
allocated  as  needed  and  the  development  of  future  AIS  programs  will  be 
deferred  accordingly. 

6.  Concur.  One  representative  from  V0200  and  another  from  D0200  have 
attended  a  DoD  Computer  Institute  sponsored  life-cycle  management  course. 
A  cross-training  program  is  being  implemented  to  ensure  V0200  and  D0200 
program  and  project  managers  are  cognizant  of  DoD  life-cycle  management 
requirements.  Additional  training  will  be  planned  for  next  fiscal  year. 

7.  Concur.  Management  control  objectives  and  control  techniques  of 
internal  control  are  being  developed  and  internal  controls  applicable  to 
the  acquisition  of  ADP  hardware  and  software  are  being  assessed. 

Internal  control  tracking  systems  are  also  being  designed  and  will  be 
developed,  tested  and  deployed.  These  initiatives  will  be  completed  by 
September  28,  1990. 
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SUMMARY  OF  BENEFITS  RESULTING  FROM  AUDIT 


Recommendation 

Reference 


1 


2 


3 


4 


5 


6 


7 


Description  of  Benefit 


Amount  and 
Type  of  Benefit 


Compliance  with  DoD  Nonmonetary. 

regulatory  guidance  for 

automated  information 

systems  development  and 

acquisition. 

Economy  and  efficiency  to  Nonmonetary, 

complete  the  development 
of  an  automated  information 
system. 


Economy  and  efficiency  to  Nonmonetary, 

complete  the  development  of 
an  automated  information 
system. 

Economy  and  efficiency  that  Undeterminable  — / 
makes  excess  automated  Cost  Avoidance, 

data  processing  equip¬ 
ment  available  to 
another  DoD  Component  or 
Government  agency. 


Compliance  with  DoD  Nonmonetary, 

regulatory  guidance  for  the 
development  and  acquisition 
of  future  automated  infor¬ 
mation  systems. 


Economy  and  efficiency  to  Nonmonetary. 

provide  automated  data 

processing  personnel 

sufficient  training  in  life- 

cycle  management  methods 

and  practices. 


Internal  controls  for  the  Nonmonetary. 

development  of  management 

control  objectives,  control 

techniques,  and  to  assess 

internal  controls  applicable 

to  the  acquisition  of  automated 

data  processing  hardware  and 

software . 


— /  Monetary  benefits  cannot  be  determined  until  a  DoD  Component 
or  Government  agency  has  acquired  the  excessed  automated  data 
processing  equipment  from  the  Defense  Automation  Resources 
Information  Center. 
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APPENDIX  C 


ACTIVITIES  VISITED  OR  CONTACTED 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Policy,  Washington,  DC 
Comptroller  of  the  Department  of  Defense,  Washington,  DC 

Department  of  the  Army 

Defense  Supply  Service,  Washington,  DC 

Department  of  the  Navy 

Chief  of  Naval  Research,  Arlington,  VA 
Other  Defense  Agencies 

Defense  Investigative  Service,  Washington,  DC 
Defense  Logistics  Agency,  Columbus,  OH 

Defense  Construction  Supply  Center,  Columbus,  OH 

Non-Government  Activities 


International 

International 


Business  Machines, 
Business  Machines, 


Bethesda,  MD 
Columbus,  OH 
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APPENDIX  D 


AUDIT  TEAM  MEMBERS 


David  A.  Brinkman,  Director 
Kathleen  M.  Stanley,  Program  Director 
Ronald  M.  Nelson,  Project  Manager 
Wanda  A.  Hopkins,  Team  Leader 
Zita  D.  Liogys,  Team  Leader 
Rudolf  Noordhuizen,  Team  Leader 
Alma  J.  Wolfe,  Team  Leader 
Arlillian  Coleman,  Auditor 
Consolacion  Loflin,  Auditor 
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APPENDIX  E 


FINAL  REPORT  DISTRIBUTION 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Policy 
Comptroller  of  the  Department  of  Defense 
Assistant  Secretary  of  Defense  (Public  Affairs) 

Department  of  the  Army 

Defense  Supply  Service-Washington 

Defense  Agencies 

Defense  Investigative  Service 
Defense  Logistics  Agency,  Columbus,  OH 

Defense  Construction  Supply  Center,  Columbus,  OH 

Non-DoD  Activities 


Office  of  Management  and  Budget 

U.S.  General  Accounting  Office, 

NSIAD  Technical  Information  Center 

Congressional  Committees: 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 

Senate  Ranking  Minority  Member,  Committee  on  Armed  Services 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Ranking  Minority  Member,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Operations 
House  Subcommittee  on  Legislation  and  National  Security, 
Committee  on  Government  Operations 
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